Description
A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server
(389-ds-base). After a successful SASL bind with integrity protection (SSF > 0),
an authenticated attacker can send a specially crafted oversized LDAP UNBIND packet
that is copied into a 512-byte heap receive buffer without a bounds check in
sasl_io_recv() in sasl_io.c. This allows up to approximately 2 megabytes of
attacker-controlled data to overflow the buffer, causing a denial of service (server
crash). In FreeIPA and Red Hat Identity Management deployments, any domain user with
a valid Kerberos ticket, any enrolled host, or any service account can trigger this
vulnerability over the network after authenticating via GSSAPI.
The vulnerable code path has existed since approximately 2013 (389-ds-base 1.3.2) and
was not addressed by the CVE-2025-14905 fix, which patched a separate heap overflow
in schema.c only.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| 389ds | 389-ds-base | 1.3.2 – ≤ 3.3.0 | — |
| Red Hat | Red Hat Directory Server 11.5 E4S for RHEL 8 | — | — |
| Red Hat | Red Hat Directory Server 11.7 E4S for RHEL 8 | — | — |
| Red Hat | Red Hat Directory Server 11.9 for RHEL 8 | — | — |
| Red Hat | Red Hat Directory Server 12.2 E4S for RHEL 9 | — | — |
| Red Hat | Red Hat Directory Server 12.4 E4S for RHEL 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | — |
| Red Hat | Red Hat Directory Server 13.2 | — | — |
| Red Hat | Red Hat Directory Server 12 | — | — |
| Red Hat | Red Hat Directory Server 13 | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | 389-ds-base | No fix yet | — |
| Debian 12 | 389-ds-base | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | 389-ds-base | No fix yet | — |
| Ubuntu 26.04 LTS | 389-ds-base | No fix yet | — |
| Ubuntu 25.10 | 389-ds-base | No fix yet | — |
| Ubuntu 24.04 LTS | 389-ds-base | No fix yet | — |
| Ubuntu 22.04 LTS | 389-ds-base | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | 389-ds-base | No fix yet | — |
| Ubuntu Pro 18.04 LTS | 389-ds-base | No fix yet | — |
| Ubuntu Pro 16.04 LTS | 389-ds-base | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | 389-ds-base +5 | 3.2.0-8.el10_2 | RHSA-2026:36196 |
| RHEL 9 | 389-ds-base +4 | 2.8.0-8.el9_8 | RHSA-2026:36195 |
| RHEL 8 | 389-ds-base +5 | 1.4.3.39-25.module+el8.10.0+24462+1b66c107 | RHSA-2026:36201 |
Show 14 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | 389-ds-base +5 | 3.0.6-19.el10_0 | RHSA-2026:36670 |
| RHEL 9.6 EUS | 389-ds-base +4 | 2.6.1-22.el9_6 | RHSA-2026:36671 |
| RHEL 9.4 E4S | 389-ds-base +2 | 2.4.5-26.el9_4 | RHSA-2026:36198 |
| RHEL 9.2 E4S | 389-ds-base +2 | 2.2.4-19.el9_2 | RHSA-2026:36585 |
| RHEL 8.8 TUS | 389-ds-base +5 | 1.4.3.35-19.module+el8.8.0+24470+25f37233 | RHSA-2026:36197 |
| RHEL 8.8 E4S | 389-ds-base +5 | 1.4.3.35-19.module+el8.8.0+24470+25f37233 | RHSA-2026:36197 |
| RHEL 8.6 EUS Long Life | 389-ds-base +5 | 1.4.3.34-10.module+el8.6.0+24464+c3b0cd7a | RHSA-2026:36202 |
| RHEL 8.6 AUS | 389-ds-base +5 | 1.4.3.34-10.module+el8.6.0+24464+c3b0cd7a | RHSA-2026:36202 |
| RHEL 8.4 EUS Long Life | 389-ds-base +5 | 1.4.3.34-5.module+el8.4.0+24472+7ce5ce41 | RHSA-2026:36206 |
| RHEL 8.4 AUS | 389-ds-base +5 | 1.4.3.34-5.module+el8.4.0+24472+7ce5ce41 | RHSA-2026:36206 |
| RHEL 7 ELS | 389-ds-base +3 | 1.3.11.1-13.el7_9 | RHSA-2026:36205 |
| Red Hat Directory Server E4s 12 | 389-ds-base +5 | 2.2.7-16.module+el9dsrv+24460+990bd826 | RHSA-2026:36641, RHSA-2026:36209 |
| Red Hat Directory Server E4s 11 | 389-ds-base +6 | 1.4.3.34-7.module+el8dsrv+24471+245dd8e2 | RHSA-2026:36208, RHSA-2026:36204 |
| Red Hat Directory Server 11 | 389-ds-base +6 | 1.4.3.39-25.module+el8dsrv+24463+e272972e | RHSA-2026:36200 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | 389-ds-base +5 | 3.2.0-8.el10_2 | ALSA-2026:64785, ALSA-2026:36196 |
| AlmaLinux 9 | 389-ds-base +4 | 2.8.0-8.el9_8 | ALSA-2026:64784, ALSA-2026:36195 |
| AlmaLinux 8 | 389-ds-base +5 | 1.4.3.39-25.module_el8.10.0+4214+f26e0f43 | ALSA-2026:36201 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | 389-ds-base | 3.2.0-8.el10_2 | RLSA-2026:36196 |
| Rocky Linux 9 | 389-ds-base | 2.8.0-8.el9_8 | RLSA-2026:36195 |
| Rocky Linux 8 | 389-ds-base | 1.4.3.39-25.module+el8.10.0+40233+16963435 | RLSA-2026:36201 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | 389-ds | 2.7.0~git212.9b0755edb-150700.3.19.1 | SUSE-SU-2026:3138-1 |
| SLES 15 SP6 | 389-ds | 2.2.10~git255.752643c78-150600.8.32.1 | SUSE-SU-2026:3136-1 |
| SLES 15 SP5 | 389-ds | 2.2.10~git255.752643c78-150500.3.48.1 | SUSE-SU-2026:3137-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | 389-ds | 3.0.6~git382.7a51ea5f5-160000.1.1 | SUSE-SU-2026:23574-1 |
| SLES for SAP 15 SP6 | 389-ds | 2.2.10~git255.752643c78-150600.8.32.1 | SUSE-SU-2026:3136-1 |
| SLES for SAP 15 SP5 | 389-ds | 2.2.10~git255.752643c78-150500.3.48.1 | SUSE-SU-2026:3137-1 |
| SLES 16.0 | 389-ds | 3.0.6~git382.7a51ea5f5-160000.1.1 | SUSE-SU-2026:23574-1 |
| SLE HPC 15 SP5 | 389-ds | 2.2.10~git255.752643c78-150500.3.48.1 | SUSE-SU-2026:3137-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | 389-ds | 3.2.2+4b41542b2-1.1 | openSUSE-SU-2026:11600-1 |
| openSUSE Leap 16.0 | 389-ds | 3.0.6~git382.7a51ea5f5-160000.1.1 | openSUSE-SU-2026:21691-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | 389-ds-base +3 | 1.3.10.2-17.amzn2.0.8 | ALAS2-2026-3853 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | 389-ds-base | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | 389-ds-base +5 | 3.2.0-8.el10_2 | ELSA-2026-36196 |
| Oracle Linux 9 | 389-ds-base +4 | 2.8.0-8.el9_8 | ELSA-2026-36195 |
| Oracle Linux 8 | 389-ds-base +5 | 1.4.3.39-25.module+el8.10.0+90949+c5bfd23c | ELSA-2026-36201 |
| Oracle Linux 7 | 389-ds-base +3 | 1.3.11.1-5.0.11.el7_9 | ELSA-2026-36205 |
Advisories 36
- ALSA-2026:64784 Critical: 389-ds-base security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:36195 Important: 389-ds-base security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:64785 Critical: 389-ds-base security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:36196 Important: 389-ds-base security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:36201 Important: 389-ds:1.4 security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-2225 Red Hat Enterprise Linux (389-ds-base): Mehrere Schwachstellen ermöglichen Codeausführung und DoS BSI CERT-Bund (WID) · Oct 14, 2026
- SUSE-SU-2026:23574-1 Security update for 389-ds SUSE / openSUSE Security Updates · Sep 29, 2026
- RHSA-2026:36671 Red Hat Security Advisory: 389-ds-base security update Red Hat Security Advisories (RHSA) · Sep 24, 2026
- RHSA-2026:36670 Red Hat Security Advisory: 389-ds-base security update Red Hat Security Advisories (RHSA) · Sep 24, 2026
- RHSA-2026:36641 Red Hat Security Advisory: redhat-ds:12 security update Red Hat Security Advisories (RHSA) · Sep 24, 2026
- RHSA-2026:36585 Red Hat Security Advisory: 389-ds-base security update Red Hat Security Advisories (RHSA) · Sep 24, 2026
- RHSA-2026:36209 Red Hat Security Advisory: redhat-ds:12 security update Red Hat Security Advisories (RHSA) · Sep 24, 2026
- RHSA-2026:36206 Red Hat Security Advisory: 389-ds:1.4 security update Red Hat Security Advisories (RHSA) · Sep 24, 2026
- RHSA-2026:36208 Red Hat Security Advisory: redhat-ds:11 security update Red Hat Security Advisories (RHSA) · Sep 24, 2026
- RHSA-2026:36205 Red Hat Security Advisory: 389-ds-base security update Red Hat Security Advisories (RHSA) · Sep 24, 2026
- RHSA-2026:36202 Red Hat Security Advisory: 389-ds:1.4 security update Red Hat Security Advisories (RHSA) · Sep 24, 2026
- RHSA-2026:36204 Red Hat Security Advisory: redhat-ds:11 security update Red Hat Security Advisories (RHSA) · Sep 24, 2026
- RHSA-2026:36200 Red Hat Security Advisory: redhat-ds:11 security update Red Hat Security Advisories (RHSA) · Sep 24, 2026
- RHSA-2026:36201 Red Hat Security Advisory: 389-ds:1.4 security update Red Hat Security Advisories (RHSA) · Sep 24, 2026
- RHSA-2026:36198 Red Hat Security Advisory: 389-ds-base security update Red Hat Security Advisories (RHSA) · Sep 24, 2026
- RHSA-2026:36197 Red Hat Security Advisory: 389-ds:1.4 security update Red Hat Security Advisories (RHSA) · Sep 24, 2026
- RHSA-2026:36195 Red Hat Security Advisory: 389-ds-base security update Red Hat Security Advisories (RHSA) · Sep 24, 2026
- RHSA-2026:36196 Red Hat Security Advisory: 389-ds-base security update Red Hat Security Advisories (RHSA) · Sep 24, 2026
- openSUSE-SU-2026:21691-1 Security update for 389-ds SUSE / openSUSE Security Updates · Aug 31, 2026
- openSUSE-SU-2026:11600-1 389-ds-3.2.2+4b41542b2-1.1 on GA media SUSE / openSUSE Security Updates · Aug 27, 2026
- ELSA-2026-36205 Important: 389-ds-base security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 24, 2026
- ALAS2-2026-3853 Important: 389-ds-base security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 4, 2026
- SUSE-SU-2026:3138-1 Security update for 389-ds SUSE / openSUSE Security Updates · Jul 21, 2026
- SUSE-SU-2026:3136-1 Security update for 389-ds SUSE / openSUSE Security Updates · Jul 21, 2026
- SUSE-SU-2026:3137-1 Security update for 389-ds SUSE / openSUSE Security Updates · Jul 21, 2026
- ELSA-2026-36196 Important: 389-ds-base security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 16, 2026
- RLSA-2026:36201 Important: 389-ds:1.4 security update Rocky Linux Security Advisories · Jul 9, 2026
- RLSA-2026:36195 Important: 389-ds-base security update Rocky Linux Security Advisories · Jul 8, 2026
- RLSA-2026:36196 Important: 389-ds-base security update Rocky Linux Security Advisories · Jul 8, 2026
- ELSA-2026-36201 Important: 389-ds:1.4 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 8, 2026
- ELSA-2026-36195 Important: 389-ds-base security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 7, 2026
References
- RHSA-2026:36195 vendor-advisory
- RHSA-2026:36196 vendor-advisory
- RHSA-2026:36197 vendor-advisory
- RHSA-2026:36198 vendor-advisory
- RHSA-2026:36200 vendor-advisory
- RHSA-2026:36201 vendor-advisory
- RHSA-2026:36202 vendor-advisory
- RHSA-2026:36204 vendor-advisory
- RHSA-2026:36205 vendor-advisory
- RHSA-2026:36206 vendor-advisory
- RHSA-2026:36208 vendor-advisory
- RHSA-2026:36209 vendor-advisory
- RHSA-2026:36585 vendor-advisory
- RHSA-2026:36641 vendor-advisory
- RHSA-2026:36660 vendor-advisory
- RHSA-2026:36670 vendor-advisory
- RHSA-2026:36671 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-11610 vdb-entry
- RHBZ#2484414 issue-tracking